bafkreiclpm47nycdhv7rwo47ynjy7z6i56vkmty2rm77ns4ocfqa7czuoe[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk generic phishing threat targeting credential theft through an IPFS gateway interface. Analysis indicates the resource, accessible via bafkreiclpm47nycdhv7rwo47ynjy7z6i56vkmty2rm77ns4ocfqa7czuoe.ipfs.dweb.link, presents a deceptive service worker gateway page titled 'IPFS Service Worker Gateway | HEAD@572bc4a,' designed to harvest user credentials under the guise of legitimate decentralized web functionality. Infrastructure analysis reveals the domain resolves to IP address 209.94.90.3 and was registered through CSC Corporate Domains, Inc. on February 24, 2017. Detection metrics show 15 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on at least one security blocklist. The domain employs Let's Encrypt SSL certificates and is assigned a Gridinsoft trust score of 0/100. Technologies detected include IPFS, Cloudflare, and HTTP/3, which may be leveraged to obfuscate malicious activity or enhance phishing page delivery. Mitigation against this credential theft threat requires immediate blocking of the domain and associated IP address 209.94.90.3 at the network perimeter. Organizations should deploy endpoint detection rules to identify and prevent access to IPFS-based phishing gateways, particularly those presenting service worker interfaces. Security teams are advised to monitor for anomalous HTTP/3 traffic patterns and validate SSL certificate chains, as phishing campaigns frequently exploit legitimate certificate authorities to lend credibility. User awareness training should emphasize the risks of decentralized web gateways and the potential for credential harvesting through seemingly technical or developer-oriented interfaces.